Categories: CloudVirtualisation

OpenStack Launches Kata Containers Project To Improve Security

The OpenStack Foundation announced a new effort called Kata Containers on Dec. 5, in a bid to help organizations deploy and run containers more securely in the cloud.

The Kata Containers project is going to be run as a separate project from the main OpenStack cloud platform, with its own governance and project direction. At the core of Kata Containers are code contributions from Intel with Clear Containers and Hyper with runv.

Other companies that are supporting the project at launch include: 99cloud, AWcloud, Canonical, China Mobile, City Network, CoreOS, Dell/EMC, EasyStack, Fiberhome, Google, Huawei, JD.com, Mirantis, SUSE, Tencent, Ucloud and ZTE.

OpenStack Kata Containers

“The Kata Containers project is very much focused on technology at the infrastructure level that fills gaps for organizations trying to run containers securely in production,” Jonathan Bryce, Executive Director of the OpenStack Foundation told eWEEK.

Intel had been developing its’ open-source Clear Containers technology since 2015 as a way to help provide a base-layer hypervisor on which a container runtime can operate. Among the early backers of Clear Containers was CoreOS which uses the technology as part of its rkt container runtime. Hyper has been building a complementary effort called runv, which is intended to be a hypervisor based runtime for Open Container Initiative (OCI) compliant container technologies.

Bryce noted that there are two approaches to running container workloads, either to run the container natively on a server operating system, or to run it inside of a virtual machine hypervisor, to provide an additional layer of isolation. The challenge has been that with a full virtual machine hypervisor, there is additional resource overhead which can impact performance.

“Kata Containers is creating a middle ground with a very lightweight virtualization layer that the container runs in and that enables users to have isolation and security,” Bryce said. “It is so small and lightweight that it’s able to have very fast startup times and has minimal additional overhead.”

James Kulina, Chief Operating Officer at Hyper told eWEEK that his company had been talking with Intel for over a year about collaborating on the secure container project. He noted that Intel’s Clear Containers and Hyper’ runV were similar efforts.

“We have already been merging code for a base that enables the Kata launch,” Kulina said.

Kulina explained that Kata reworks the virtualization layer, so instead of putting in a full operating system which is normally what a traditional hypervisor does, Kata uses a stripped down kernel that enables the container to launch and run. The actual virtual machine technology that is being used for Kata is the open-source KVM hypervisor.

Kulina noted that the plan is to add support for other hypervisors in Kata, including the open-source Xen hypervisor. Kata is not going to be supporting VMware’s hypervisor, which has its own approach to running containers known as vSphere Integrated Containers.

Linux vendor Canonical has also had its’ own open-source project for a container hypervisor called LXD that first debuted back in 2014. Bryce noted that LXD is different than Kata in multiple ways.

“Kata is entirely focused on container workloads, it’s an execution environment for containers and is not meant to run an entire virtual machine,” Bryce said.

Does IoT security concern you?

  • Yes (89%)
  • No (11%)

Loading ...

OpenStack

Supporting containers technology is not a new thing for OpenStack. The OpenStack cloud platform already has multiple container projects including Magnum for Kubernetes orchestration and Zun for launching and managing containers. Bryce explained that Kata is set to be supported in Zun, with users being able to directly create a Kata container from Zun.

He added that with Magnum, a cloud operator could create a Kubernetes environment that runs a Kubernetes pod inside of Kata containers.

Though Kata can work with other OpenStack projects, it is being run as an independent project, with its own governance and technical leadership drawn from the contributor base. Kata will also have usefulness beyond just OpenStack as well.

“OpenStack users will be able to benefit from the Kata technology, but there are many other use-cases that are outside of OpenStack cloud where container security is really important,” Bryce said.

Originally published on eWeek

Sean Michael Kerner

Sean Michael Kerner is a senior editor at eWeek and contributor to TechWeek

Recent Posts

Ericsson To Cut 1,200 Jobs in Sweden Amid ‘Challenging’ Market

Swedish telecoms giant Ericsson blamed “challenging mobile networks market” and “further volume contraction” for job…

15 hours ago

FTX’s Sam Bankman-Fried Sentenced To 25 Years In Prison For $8bn Fraud

Dramatic downfall. Sam Bankman-Fried sentenced to 25 years in prison for masterminding $8bn fraud that…

16 hours ago

Elon Musk Orders FSD Demo For Every Tesla US Sale

Fallout avoidance? Tesla buyers in the US must be shown how to use the FSD…

17 hours ago

Amazon Pumps Another $2.75 Billion Into Anthropic

Amazon completes its $4bn investment into AI firm Anthropic, after providing an additional $2.75bn in…

19 hours ago

The Sustainability of AI

While AI promises unparalleled efficiency, productivity, and innovation, questions regarding its environmental impact loom large.…

21 hours ago

Trump’s Truth Social Makes Successful Market Debut

Shares in Donald Trump’s social media company rose about 16 percent after first day of…

22 hours ago